@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105845 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105845 Source advisory: GHSA-V49J-62M6-PGRR...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105845 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105845 Source advisory: OSV:GHSA-V49J-62M6-PGRR...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: SNYK:JS-PAYLOAD-20571762...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: OSV:GHSA-W84C-53H3-MC2G...

@payloadcms/plugin-search (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via @payloadcms/next (>=4.0.0-canary.0, <=4.0.0-canary.26)

@payloadcms/next NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: SNYK:JS-PAYLOADCMSNEXT-20571761...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: GHSA-W84C-53H3-MC2G...

@payloadcms/plugin-search (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via @payloadcms/next (>=4.0.0-canary.0, <=4.0.0-canary.26)

@payloadcms/next NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: GHSA-W84C-53H3-MC2G...

@payloadcms/plugin-search (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via @payloadcms/next (>=4.0.0-canary.0, <=4.0.0-canary.26)

@payloadcms/next NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: OSV:GHSA-W84C-53H3-MC2G...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105847 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105847 Source advisory: SNYK:JS-PAYLOAD-20571409...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105847 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105847 Source advisory: OSV:GHSA-FPWW-C55P-CJV6...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105847 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105847 Source advisory: GHSA-FPWW-C55P-CJV6...

EUVD-2026-93490

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...

CVE-2026-105848 Payload: Insufficient Access Control in Stripe REST Proxy

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...

CVE-2026-105848 Payload: Insufficient Access Control in Stripe REST Proxy

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is...

@frogbotai/plugin-stripe (>=0.14.0, <=0.23.0) potentially affected by CVE-2026-105848 via @payloadcms/plugin-stripe (>=3.85.1, <=3.88.0)

@payloadcms/plugin-stripe NPM version =3.85.1, =0.14.0, =0.23.0 Source cves: CVE-2026-105848 Source advisory: MEND:CVE-2026-105848...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105847 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105847 Source advisory: MEND:CVE-2026-105847...

@payloadcms/plugin-search (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via @payloadcms/next (>=4.0.0-canary.0, <=4.0.0-canary.26)

@payloadcms/next NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: MEND:CVE-2026-105846...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: MEND:CVE-2026-105846...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105845 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105845 Source advisory: MEND:CVE-2026-105845...

CVE-2026-105844 Payload: Prototype pollution in Payload Import Export plugin

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended applicatio...